Update main.yml

added security scanning with trivy

.github/workflows/main.yml

@@ -1,28 +1,76 @@
 name: Build and Test
 
 on: 
+  pull_request:  
+    branches: [main]
   push:
-    branches:  [main]
-  pull_request:
     branches: [main]
 
+
 jobs:
-  build: 
+
+  trivy_scan:
+    runs-on: ubuntu-latest
+    steps: 
+
+      - name: checkout code
+        uses: actions/checkout@v3
+
+      - name: Run Trivy vulnerability scanner 
+        uses: aquasecurity/trivy-action@master
+        with: 
+          scan-type: 'fs'
+          ignore-unfixed: true
+          format: 'sarif'
+          output: 'results.sarif'
+          severity: 'CRITICAL'
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: 'results.sarif'
+
+
+
+  build_and_upload_image:
+    needs: [trivy_scan]
 
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@v3
+
+      - uses: mr-smithers-excellent/docker-build-push@v6
+        with:
+          image: artimus47/iclass
+          tags: latest
+          registry: docker.io
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v3
-
+
+  trivy_image_scan:
+     needs: [build_and_upload_image]
+
+     runs-on: ubuntu-latest
+     steps:
+
+      - name: Login to Docker registry
+        run: docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Pull Docker image
+        run: docker pull artimus47/iclass
 
-      - name: build image
-        run: docker build -t vue-app .
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: 'artimus47/iclass:latest'
+          format: 'sarif'
+          output: 'image-results.sarif'
 
-      - name: run build
-        run: |
-          npm install
-          npm run build 
-   
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: 'image-results.sarif'
+